If some campaigners against the UK’s Investigatory Powers (IP) Bill are to be believed, the use of bulk powers (or mass surveillance) by UK intelligence agencies is not only bad for your privacy, but the powers are also ineffective.

Download this free guide

Computer Weekly's Buyer's Guide to GDPR

The race is on to get ready for GDPR next year. Computer Weekly looks at how to deal with data under the regulation, how compliance will affect businesses, and what organisations should do to prepare.

Like all plausible arguments, this has elements of truth. Intelligence agencies are struggling to cope with data volumes. And missed intelligence leads have resulted in successful terrorist attacks. However, the argument’s conclusion – that these issues and failures are a direct consequence of a bulk data collection approach – is flawed.

This is primarily due to the conflation of a range of issues. Conflation between the National Security Agency (NSA) and the UK agencies; between collection and analysis; between metadata and content; and, most importantly, between the past and the present.

If UK intelligence analysts are “overwhelmed by data”, there is little to suggest this is a symptom of bulk powers. Instead, it reflects the extent of the challenges faced by the UK government – there are too many intelligence targets. And, fundamentally, the reality of life in 2016 – multiple communications devices, permanent connectivity, and data generation on an unprecedented scale.

So how do the UK intelligence agencies use bulk data in 2016? As part of the IP Bill process, the government commissioned a review to find out. The central conclusion of the review is clear – bulk data collection and analysis (at least in the UK context) works. Despite Binney’s claims to the contrary, there is a “clear operational case”.

However, effectiveness should not be the only criterion on which these powers are judged. Apart from the critical privacy and proportionality questions, are there alternative but less intrusive methods that could be equally successful?

Again, the review was categorical. While alternative methods could sometimes be used, they would often be “less effective, more dangerous, more resource-intensive, more intrusive or slower”.

Unique value

This conclusion points to bulk data’s unique value compared with other intelligence approaches.

It can be used in parts of the world where deploying a human intelligence asset would be too risky. It allows intelligence agencies to respond quickly – both to new and emerging threats and to the never-ending challenge of identifying or re-acquiring communications devices or individuals of interest. And, importantly, to do so without intrusively targeting dozens of potential suspects in a resource-intensive way.

What the argument against bulk powers also misunderstands is the correlation between collection and analysis. Intelligence agencies can’t and don’t want to analyse this data in its entirety.

Which is why bulk datasets should not overwhelm intelligence analysts. Rather like the evolution in search engine capability, bulk collection has allowed intelligence analysts to ask smarter questions. And to do so with greater confidence, knowing they are querying a broader and more comprehensive dataset.

Although these bulk powers are only now being formalised in legislation, they are not new powers taking time and resources away from established methodologies. They lie at the heart of how the UK intelligence community functions in the internet age.

So while the issues of privacy and proportionality will rightly be debated in Parliament over the next few weeks, we should be clear about what is at stake – removing or constraining bulk powers will reduce the UK intelligence agencies’ ability to counter a range of threats.

David Wells is a former GCHQ intelligence officer. ..........................................................................................................................................

0 comments

Register

Login

Forgot your password?

Your password has been sent to:

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy